CVE-2017-16949

An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the attacker to override the settings for allowed file extensions and upload file size, related to inc/cores/file-uploader.php and file-uploader/file-uploader-class.php. This allows the attacker to upload anything they want to the server, as demonstrated by an action=ap_file_upload_action&allowedExtensions[]=php request to /wp-admin/admin-ajax.php that results in a .php file upload and resultant PHP code execution.

• CWE-434

• http://packetstormsecurity.com/files/145398/Accesspress-Anonymous-Post-Pro-Unauthenticated-Arbitrary-File-Upload.htmlExploit, Third Party Advisory, VDB Entry
• https://wpvulndb.com/vulnerabilities/8977Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/43324/Exploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/145398/Accesspress-Anonymous-Post-Pro-Unauthenticated-Arbitrary-File-Upload.htmlExploit, Third Party Advisory, VDB Entry
• https://wpvulndb.com/vulnerabilities/8977Exploit, Third Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/43324/Exploit, Third Party Advisory, VDB Entry

Published

Dec 19, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-16942In libsndfile 1.0.25 (fixed in 1.0.26), a divide-by-zero err…
• CVE-2017-16943The receive_msg function in receive.c in the SMTP daemon in …
• CVE-2017-16944The receive_msg function in receive.c in the SMTP daemon in …
• CVE-2017-16945The standardrestorer binary in Arq 5.10 and earlier for Mac …
• CVE-2017-16946The admin_edit function in app/Controller/UsersController.ph…
• CVE-2017-16948TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to ca…
• CVE-2017-1695IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected crypto…5.9
• CVE-2017-16950Cross - site scripting (XSS) vulnerability in UrBackup Serve…
• CVE-2017-16951Winamp Pro 5.66 Build 3512 allows remote attackers to cause …5.5
• CVE-2017-16952KMPlayer 4.2.2.4 allows remote attackers to cause a denial o…
• CVE-2017-16953connoppp.cgi on ZTE ZXDSL 831CII devices does not require HT…
• CVE-2017-16955SQL injection vulnerability in the InLinks plugin through 1.…